Last updated: 18 August 2026
🌍 This translation is provided for information purposes only. The legally binding version is the Turkish text: Turkish version
1.1. Under this notice, prepared in order to fulfil the information obligation set out in Article 10 (m.10) of the Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data are processed by EkoHarita, acting as data controller, through kardesbitkiler.org, a product of the EkoHarita family (the “Platform”), within the scope described below.
1.2. Contact: info@ekoharita.org or the contact form on the Platform · Brand: ekoharita.org
1.3. The Platform is subject to EkoHarita's Membership Agreement and Terms of Use (the “Master Agreement”). The privacy and personal-data provisions specific to kardesbitkiler.org are set out in this notice; in matters not regulated in this notice, the Master Agreement (in particular the Privacy and KVKK provisions in its Article 5) applies as a supplement. In the event of a conflict between this notice and the Master Agreement, this notice takes precedence with respect to personal-data processing activities carried out through kardesbitkiler.org. The definitions of Visitor, Member and Volunteer Member in the Master Agreement also apply to this notice. For the Platform's terms of use, please also see the Terms of Use page.
1.4. The Platform interface is offered in 12 languages; the Turkish version of this information notice prevails.
2.1. We process only the minimum data necessary for the operation of the service:
| Category | Data | When / from where |
|---|---|---|
| Identity and Contact | Display name (may be a pseudonym), e-mail address | Membership registration, footer newsletter sign-up |
| Account and Verification | Password — stored as an irreversible hash using the Argon2id algorithm, never kept in plain text; e-mail verification status and records of single-use verification links | Membership registration, e-mail verification |
| Profile (optional) | Emoji avatar; location at district + country level (you are not required to enter it); your answer to the optional nature question you may answer on your profile; your preference to hide your profile from other users | Profile editing (as you enter it) |
| Content (user-generated) | Plant comments (optionally 1 photo), Chat Board messages (tagged with the language they are written in), garden journal entries (optional photo), garden plans (saving/sharing), garden photos, records of community-garden volunteering / co-ownership applications and approvals | As you create it |
| Location (only if you publish it) | District + country on your profile; if you publish your community garden on the map, a map pin — the pin corresponds to the district/region centre or to a point you mark yourself, and coordinates are rounded to four decimal places (approximately 11 metres) | Profile / community-garden publication (publication is subject to administrator approval) |
| Transaction Security | IP address (short-term), server-side automatic verification (CAPTCHA) records, rate-limit records; technical error logs (the endpoint where the error occurred, the date and, if any, the member ID — request content/passwords are never written to the logs) | Automatic, temporary — abuse/spam prevention and fault diagnosis |
| E-mail Sending Records | Sending date, sending type and recipient address (mail log) | Whenever a verification/newsletter/notification e-mail is sent |
| Form Data | Name, e-mail, subject and message in the contact form; information you enter in the book/plant suggestion and feedback forms — these forms are forwarded directly by e-mail to info@ekoharita.org and are not written to the database | Whenever you submit a form |
| Cookies and Local Storage | eko_sess session cookie (created for the operation of the service; not linked to your identity unless you sign in); eko_rmb “Remember me” cookie (only when you sign in and leave that option enabled — see Section 8.1); _ga analytics cookie (only with explicit consent); local-storage items kept in your browser (see Section 8) | During use |
2.2. What we do not collect: Home/street address (location is at most at district level), Turkish (T.C.) national identity number, financial/payment data (no payments are taken or processed on the Platform; donations are made through links directing to external platforms such as Patreon/Kreosus/Voxvil, under those platforms' own responsibility) and special categories of personal data within the meaning of Article 6 (m.6) of the KVKK.
2.3. Consistently with Article 3 of the Master Agreement, the content you share on the Platform (comments, board messages, journal entries, plans, photos) becomes visible to other users and is associated with your display name. The visibility of your profile and location information, however, depends solely on your own choice (Section 3.2).
3.1. Each processing purpose relies on the legal basis stated next to it:
| Purpose | Data processed | Legal basis |
|---|---|---|
| Establishing and operating membership: registration, e-mail verification, sign-in, session management, account security | Identity/contact, account, session cookie, e-mail sending records | Conclusion and performance of a contract (m.5/2-c) |
| Providing community features: comments, Chat Board, garden journal, garden plan, garden sharing, community-garden volunteering/co-ownership | Content, profile | Performance of a contract (m.5/2-c) |
| Sending newsletter and announcement e-mails | E-mail, name, newsletter sending records | Explicit consent (m.5/1) — double opt-in: registration only becomes final when you click the confirmation link sent to you; every newsletter e-mail contains an “unsubscribe” link |
| Displaying your location and your community garden on the map | District+country, rounded pin coordinate | Explicit consent (m.5/1) — only if you publish it yourself; publication of a community garden on the map is additionally subject to administrator approval |
| Site usage statistics (Google Analytics) | Analytics cookie data | Explicit consent (m.5/1) — only if you give permission in the cookie banner (Section 8.4) |
| Security, prevention of spam and abuse; content moderation (automatic profanity filter, hiding upon complaint, administrator/Volunteer review) | IP, CAPTCHA/rate-limit records, content | Legitimate interest (m.5/2-f) |
| Receiving, evaluating and responding to contact requests, book/plant suggestions and feedback | Form data (name, e-mail, subject/reason, message and any other information you enter in the form) | Legitimate interest (m.5/2-f) — fulfilment of your request; if your request concerns the exercise of a right, the relevant legal basis also applies |
| Responding to lawful requests of competent authorities and fulfilling legal obligations | Relevant records | Explicit provision in law / legal obligation (m.5/2-a, m.5/2-ç) |
3.2. Processing based on explicit consent can be withdrawn at any time: you can unsubscribe from the newsletter via the link in every e-mail, remove your profile/community-garden location from publication, and reset your analytics cookie preference with the button in Section 8.5. Withdrawal of consent does not affect the lawfulness of processing carried out up to the moment of withdrawal.
3.3. How moderation works: Photos you upload are published only after administrator/Volunteer Member approval. Content caught by the profanity filter is automatically hidden and submitted for human review; content that receives 5 complaints is likewise automatically hidden. You may request administrator review of an automatic hiding decision (in connection with Section 10.1-g).
Within the meaning of KVKK m.10, your personal data are collected entirely in electronic form; (a) from information you enter through the forms on the Platform (membership, profile, content creation, newsletter sign-up, contact/suggestion/feedback forms), (b) by automatic means during the operation of the service (session cookie, IP/security records, e-mail sending records), and (c) where you have given explicit consent, through analytics cookies.
5.1. Your data are not sold, rented or shared with third parties for advertising purposes. Under this section, which gives concrete effect for kardesbitkiler.org to the principle in Article 3.1 of the Master Agreement, personal information is used only for the operation of the service. In order to provide the service technically, transfers are made to a limited number of service providers (data processors):
| Recipient | Purpose | Data transferred | Location |
|---|---|---|---|
| Amazon SES | Sending verification, newsletter and notification e-mails | E-mail address, e-mail content | Abroad — EU (Ireland, eu-west-1) |
| GreenGeeks | Web hosting (server infrastructure) | All data stored on the Platform reside on the server | USA — abroad |
| OpenStreetMap / Nominatim | Map display and address-to-coordinate conversion (geocoding) | Map tiles are loaded into your browser from OpenStreetMap; the district/region name you type is sent to Nominatim to be converted into coordinates — in the process your IP address may reach the relevant provider | Abroad |
| Google (Analytics — GA4) | Usage statistics — only if you give explicit consent in the cookie banner (Section 8.4) | Cookie-based page-view and interaction data (Google Privacy Policy) | Abroad |
| Wikimedia Commons | Source of plant images | No personal data are transferred (images are served from the Platform's server) | — |
5.2. Transfers abroad (KVKK m.9): Transfers to those of the above providers whose servers are located abroad are made in a manner limited to the minimum data strictly necessary for the technical provision of the service, relying on the safeguard mechanisms under KVKK m.9 as amended by Law No. 7499 (including the data protection commitments offered by the relevant providers). Data transfers relating to analytics cookies take place only with the explicit consent you give in the cookie banner (Section 8.4).
5.3. Competent authorities: Where a legal obligation exists (upon lawful requests such as a court order or a public prosecutor's request), your personal data may be shared with competent public institutions and bodies, to the extent required by the request. No sharing with third parties takes place other than in the cases listed in this notice.
6.1. Data are retained only for as long as the processing purpose requires:
6.2. Data whose retention period has expired or whose purpose has ceased are deleted, destroyed or anonymised pursuant to KVKK m.7.
7.1. Pursuant to KVKK m.12, reasonable technical and administrative measures are taken to ensure an appropriate level of security:
7.2. As also stated in Article 3.1 of the Master Agreement, despite all reasonable measures taken, absolute security cannot be guaranteed on the internet. Choosing a strong password and protecting your sign-in credentials is your responsibility. In the event of a data breach, the obligation to notify the data subjects concerned and the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under KVKK m.12/5 is complied with.
8.1. Cookies necessary for the operation of the service: The eko_sess session cookie is created for the technical operation of the Platform (security verification, rate limiting, session management) and does not require consent; unless you sign in it is not linked to your identity, and it expires when the browser is closed. If you leave the “Remember me” option enabled when signing in, an additional eko_rmb cookie is created: it contains a random key valid for at most 400 days (it never contains your password or personal details) and keeps your session alive even after the browser is closed; it is deleted when you sign out, and you can prevent it from being created at all by unticking the option (Section 6.1). We do not use advertising cookies; analytics cookies operate only with your explicit consent and only within the scope described in Section 8.4.
8.2. Local storage (localStorage): Your language preference, your cookie preference (eko_consent_v1) and — when you use the Platform without signing in — your favourite plant list and garden plan draft are stored only in your own browser. When you sign in as a member, your favourite list and the garden plans you save are stored on the server, linked to your account, so that they can be synchronised across your devices (Section 2.1 — Content); the favourite list you built in this browser before signing in is transferred to your account on your first sign-in, and the local list is cleared from this browser when you sign out. You can delete local storage using your browser's site-data clearing feature.
8.3. Cookie banner: The banner shown on your first visit offers the options “Accept All” or “Essentials Only”. If you choose “Essentials Only”, you continue to use the entire site without any analytics cookie being written; no functionality is restricted.
8.4. Analytics cookies (Google Analytics — GA4, e.g. _ga): They operate only if you give permission
in the cookie banner (Consent Mode v2). If you do not give permission, no analytics cookie is written and no cookie-based analytics measurement takes place.
8.5. Resetting your preference: You can change your cookie preference at any time:
Membership of the Platform is open to persons who have reached the age of 18; it is not open to persons under 18, and no personal data are knowingly collected from persons under 18. Browsing of the Platform's purely informational content by a visitor under 18 is under the supervision and responsibility of their parent/guardian. If it is established that data belonging to a person under 18 have been processed, such data are deleted without delay; you can report such a situation to info@ekoharita.org.
10.1. Pursuant to KVKK m.11, by applying to the data controller you have the right to;
as data subject.
10.2. In addition, directly through Platform functions: you can unsubscribe from the newsletter with one click via the link in every e-mail, edit and remove your profile information and location publication yourself, delete your content, and hide your profile.
11.1. You may submit requests concerning your rights under Section 10, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ), in writing by e-mail to info@ekoharita.org or via the contact form.
11.2. Your application must include your name and surname, your signature if the application is in writing, your Turkish (T.C.) national identity number if you are a Turkish citizen (your nationality and passport/identity number if you are a foreign national), your address for service or your e-mail address for notification, and the subject of your request. If you have an account on the Platform, applying from the e-mail address registered to your account facilitates identity verification; otherwise, additional information suitable for verifying your identity may be requested so that data are not disclosed to the wrong person.
11.3. Your application is concluded, depending on the nature of the request, as soon as possible and in any event within 30 (thirty) days at the latest, free of charge. If the operation additionally entails a cost, only the fee in the tariff determined by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) may be charged.
11.4. Pursuant to KVKK m.14; if your application is rejected, if you find the response insufficient, or if no response is given within 30 days, you retain the right to lodge a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days from the date on which you learn of the response and in any event within 60 days from the date of the application.
12.1. EkoHarita may update this notice consistently with Article 2 of the Master Agreement. The current text is published on this page and takes effect on the date of publication; significant changes are additionally announced on the site. The “Last updated” date at the top of the page indicates the version in force.
12.2. Disputes arising from this notice are governed by Turkish Law; the Istanbul Central (Çağlayan) Courts and Enforcement Offices have jurisdiction.